JP2014081823A - File opening detection system, file opening detection method, file opening detection program and electronic file to be used for the same system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To easily detect the unauthorized opening information of an electronic file without being noticed by an unauthorized opening person, and to perform the notification of the result.SOLUTION: A file opening detection system 1 includes: a log recording part 12 (opening information recording part) for, on the basis of a data acquisition request from an electronic file 2 in which a hyper-link is embedded, recording opening log information in which at least IP address information as the transmission source of the data acquisition request is included; an opening permission list 18 (opening acceptance/rejection storage part) in which the IP address information for determining the opening acceptance/rejection of the electronic file 2 is stored; an unauthorized opening information extraction part 13 for extracting unauthorized opening log information opened with the IP address in a site where the opening of the electronic file 2 is not permitted from the opening log information recorded in the log recording part 12 by referring to the opening permission list 18; and a mail notification part 14 (unauthorized opening information notification part) for notifying a predetermined mail address of the extracted unauthorized opening log information.

Description

  The present invention relates to a file opening detection system, a file opening detection method, a file opening detection program, and an electronic file used in the system.

  A technique for preventing an electronic file from leaking or leaking is known (for example, see Patent Document 1). The technology disclosed in Patent Document 1 discloses a configuration in which environmental information immediately before an electronic file is opened is transmitted to the management server, and the opening of the electronic file is permitted when the opening condition is satisfied. .

JP 2007-304897 A

  However, in the technique disclosed in Patent Document 1, each time an electronic file is opened, in principle, information on all software resources installed in the user terminal, information on hardware resources, and the like are collected. It is transmitted to the management server, and it is determined whether or not the opening condition is satisfied on the management server side. For this reason, since it takes a certain amount of time to open the electronic file, the convenience of the electronic file is impaired for a user who is authorized to use the electronic file properly. In addition, since it takes time to open an electronic file illegally, it becomes easier to notice that some process for opening in the background is being performed, and in some cases, communication with the outside The electronic file will be analyzed in a situation where it is not possible, and there is a risk that it will not be possible to detect unauthorized opening.

  The present invention has been made in view of the above-described circumstances, and a file opening detection system, a file opening detection method, and a file opening that easily detect and notify unauthorized opening information of an electronic file without being noticed by an unauthorized opening person. It is an object to provide a detection program and an electronic file used in the present system.

  In order to solve the above-described problems, one aspect of the present invention relates to a file opening detection system. That is, the file opening detection system of the present invention records opening log information including at least IP address information that is a transmission source of the data acquisition request based on the data acquisition request from the electronic file in which the hyperlink is embedded. An information recording unit, an opening / closing storage unit storing IP address information for determining whether an electronic file can be opened, and an IP address information stored in the opening / closing storage unit. The unauthorized opening information extraction unit that extracts the unauthorized opening log information that is opened at the IP address that is not permitted to open from the opening log information that is recorded in the unopened log information, and the unauthorized opening log information that is extracted by the unauthorized opening information extraction unit And an unauthorized opening information notifying unit for notifying a predetermined mail address.

  Further, in the file opening detection system described above, the hyperlink embedded in the electronic file indicates predetermined image data, and the predetermined image data is used by introducing 1-dot image data or this system. It is preferable that the logo mark of the company to be.

  Another aspect of the present invention relates to a file opening detection method. That is, the file opening detection method of the present invention records opening log information including at least IP address information that is a transmission source of the data acquisition request based on the data acquisition request from the electronic file in which the hyperlink is embedded. The opening information recording step and the opening / closing storage unit storing the IP address information for determining whether or not to open the electronic file are referred to, and the opening is permitted from the opening log information recorded in the opening information recording step. An unauthorized opening information extracting step for extracting unauthorized opening log information opened at an unaddressed IP address, and an unauthorized opening information notifying step for notifying a predetermined mail address of the unauthorized opening log information extracted by the unauthorized opening information extraction step And.

  One aspect of the present invention relates to a file opening detection program. In other words, the file opening detection program according to the present invention causes a computer to open an opening log including at least IP address information that is a transmission source of a data acquisition request based on a data acquisition request from an electronic file in which a hyperlink is embedded. With reference to the unsealing information recording means for recording information, the unsealing availability storing means for storing the IP address information for determining whether or not the electronic file is unsealed, and the IP address information stored in the unsealing availability storage means Extracted by the unauthorized opening information extracting means for extracting the unauthorized opening log information opened at the IP address that is not permitted to open from the opening log information recorded in the opening information recording means, and the unauthorized opening information extracting means To function as a tampering information notification means for notifying tampering log information to a predetermined e-mail address It is.

  Another aspect of the present invention relates to an electronic file. In other words, the electronic file of the present invention can be detected by unauthorized opening by any of the above-described file opening detection systems.

  According to the present invention, a file opening detection system, a file opening detection method, a file opening detection program, and an electronic file used in the system for easily detecting and notifying unauthorized opening information of an electronic file without being noticed by an unauthorized opening person Can be provided.

It is the figure which showed notionally about the whole structure of the file opening detection system 1 which concerns on one embodiment of this invention. It is a flowchart which shows the process which extracts an unauthorized opening log and notifies it to a system administrator.

  Hereinafter, a file opening detection system 1 which is an embodiment of a file opening detection system of the present invention will be described with reference to the drawings. The file opening detection method and program of the present invention will be described by taking, as an example, the operation of the device included in the file opening detection system 1 and the program installed in the device included in the file opening detection system 1. However, the embodiment described below is an example embodying the present invention, and does not limit the technical scope of the present invention.

  FIG. 1 is a diagram conceptually showing the overall configuration of a file opening detection system 1 according to an embodiment of the present invention. As shown in FIG. 1, the file opening detection system 1 includes an electronic file 2, a network 3, a Web server 4, and an administrator terminal 5.

  The electronic file 2 is created by, for example, a Microsoft OFFICE product (for example, an application program such as WORD, EXCEL, and POWERPOINT). In the electronic file 2, a hyperlink to the image data 19 stored in the Web server 4 is embedded. As a method of creating the electronic file 2, for example, a template in which a hyperlink of the image data 19 is embedded is created in advance, and when the user creates a document with an electronic file, the template can be easily duplicated. Can be created. As long as the electronic file 2 has a function of embedding a hyperlink, the electronic file 2 may have a file format other than the above-described file format (for example, a PDF file).

  The network 3 includes, for example, an Internet network, a LAN (Local Area Network), a WAN (Wide Area Network), and the like. The network 3 may be configured by a dedicated line, a VPN (Virtual Private Network), a mobile phone network, a public line network, or the like.

  The Web server 4 accumulates information such as an HTML (Hyper Text Markup Language) document and image data, and transmits the information to the request source through the network 3 in response to a request from client software such as a Web browser. A server computer that can. In the present embodiment, when the electronic file 2 is opened, the image data 19 indicated by the hyperlink embedded in the electronic file 2 is automatically acquired from the Web server 4. In response to the request, the Web server 4 transmits the image data 19 to the request source.

  The Web server 4 includes a control unit 11, a log recording unit 12, an unauthorized opening information extraction unit 13, an email notification unit 14, a storage unit 15, an unauthorized opening detection program 16, log data 17, an opening permission list 18, and image data 19. Have.

The control unit 11 includes a CPU (Central Processing Unit), a RAM (Random Access).
Memory), ROM (Read Only Memory), etc., and the CPU reads the tampering detection program 16 from the storage unit 15 to the RAM, and executes the read tampering detection program 16 so that the log recording unit 12, tampering information The functions of the extraction unit 13 and the mail notification unit 14 are realized.

  In accordance with the control of the control unit 11, the log recording unit 12 stores, in the storage unit 15, the IP address information that is the access source and the date and time information of the access as log data 17 when the Web server 4 is accessed. Record. Note that the log data 17 recorded by the log recording unit 12 may include information other than the IP address information and the date / time information, or may be configured by only the IP address information.

  The unauthorized opening information extraction unit 13 extracts unauthorized opening information of the electronic file 2 from the log data 17 according to the control of the control unit 11. Specifically, the unauthorized opening information extraction unit 13 extracts, from the storage unit 15, log data 17 having IP address information that is not registered in an opening permission list 18 described later, under the control of the control unit 11. The log data 17 extracted from the storage unit 15 is supplied to the mail notification unit 14 as unauthorized opening information under the control of the control unit 11.

  The mail notification unit 14 transmits the unauthorized opening information supplied from the unauthorized opening information extraction unit 13 to a preset email address (for example, the email address of a system administrator who manages the system) under the control of the control unit 11. . As a result, the system administrator can easily know the unauthorized opening information of the electronic file 2.

  The storage unit 15 includes, for example, an HDD (Hard disk drive), an SSD (Solid State Drive), or the like. The storage unit 15 stores an unauthorized opening detection program 16, log data 17, an opening permission list 18, image data 19, and the like. In addition to the above, the storage unit 15 may be an external HDD, a USB memory, or the like, or a NAS (Network Attached Storage) constructed in the same LAN.

  In the opening permission list 18, IP addresses permitted to open the electronic file 2 are registered in advance as a list. As an IP address registered in the opening permission list 18, for example, a global IP address is registered, but the file opening detection system 1 is operated in a predetermined closed local network, for example, one company. May be a local IP address. Further, the opening permission list 18 may include a global IP address and a local IP address. The opening permission list 18 may not register individual IP addresses, but may register IP addresses included in a predetermined range (for example, registration in units of network addresses).

  The image data 19 is preferably, for example, 1-dot image data or a logo mark of a company that uses the present system, but may be image data other than these, and can be changed as appropriate. When the image data 19 is a company logo mark, for example, it may be displayed as a company logo mark displayed on a homepage.

(Unauthorized tamper detection process)
FIG. 2 is a flowchart showing a process in which the Web server 4 extracts the unauthorized opening log and notifies the system administrator. When the Web server 4 is powered on, the unauthorized opening detection program 16 is automatically executed and the processing shown in FIG. 2 is started (START). Note that the tampering detection program 16 may be executed by the user operating the Web server 4 to start the processing shown in FIG.

  Step S1: The control unit 11 of the Web server 4 determines whether there is an acquisition request for the image data 19 or not. Specifically, when the electronic file 2 is opened somewhere, an acquisition request for the image data 19 referred to by the hyperlink embedded in the electronic file is transmitted to the Web server 4 via the network 3. come. When it is determined in step S1 that there is an acquisition request for the image data 19 (YES in step S1), the image data 19 is transmitted to the acquisition request destination, and the process proceeds to step S2 to acquire the image data 19. If there is no request (NO in step S1), the presence / absence of an acquisition request for image data 19 is monitored. The image data 19 acquired from the Web server 4 is displayed on the electronic file 2 that has transmitted the acquisition request.

  Step S2: When it is determined that there is an acquisition request for the image data 19 in Step S1 (YES in Step S1), the control unit 11 controls the log recording unit 12 to record the log data 17 in the storage unit 15. Specifically, the log recording unit 12 records the IP address information that is the connection source of the acquisition request for the image data 19 and the date and time information when the acquisition request is received in the storage unit 15 as the log data 17.

  Step S3: The control unit 11 extracts the unauthorized opening log information from the log data 17 recorded in the storage unit 15. Specifically, the unauthorized opening information extraction unit 13 stores the log data 17 having IP address information not registered in the opening permission list 18, that is, the unauthorized opening log information of the electronic file 2 according to the control of the control unit 11. 15 to extract. The timing for extracting the unauthorized opening log information of the electronic file 2 in step S3 is not particularly limited. For example, it may be executed every predetermined time (for example, every 5 minutes, every hour), or the Web server 4 It may be executed when the system administrator inputs an execution instruction.

  Step S4: When the unauthorized opening log information of the electronic file 2 is extracted in step S3 (YES in step S4), the control unit 11 proceeds to the process of step S5. On the other hand, when the unauthorized opening log information of the electronic file 2 is not extracted in step S3 (NO in step S4), the control unit 11 determines that the unauthorized opening of the electronic file 2 has not been detected, and in step S1. Return to processing.

  Step S5: The control unit 11 notifies the unauthorized opening information of the electronic file 2 to the mail address addressed to the system administrator. Specifically, the mail notification unit 14 creates a mail to a preset mail address addressed to the system administrator under the control of the control unit 11, and sends a mail describing the unauthorized opening information of the electronic file 2. Transmit and end the process (END).

  As described above, in the file opening detection system 1 according to the present embodiment, a hyperlink is embedded in the electronic file 2 so as to refer to the image data 19 in the Web server 4 and the connection source IP address is opened. If the IP address is not registered in the list 18, it is determined that the file has been tampered with, and the system administrator is automatically notified of the tampering information of the electronic file 2 by e-mail. Information leakage of the electronic file 2 can be easily detected without being noticed by the unauthorized opener, and the fact of unauthorized opening can be notified to the system administrator. Further, since the unauthorized opening information includes the IP address information as the transmission source, it is possible to grasp the IP address information as the information leakage destination. Further, in order to create the electronic file 2 in this embodiment, it is only necessary to use a template for the electronic file 2 created in advance, such as an existing electronic file operation method and an existing in-house system security policy. There is no need to change the rules significantly. In addition, since the file opening detection system 1 according to the present embodiment can be constructed only by setting the template for creating the electronic file 2 and the setting of the Web server 4 in an existing in-house system or the like, the book can be made very easily and inexpensively. It is possible to build a system.

  The hyperlink embedded in the electronic file 2 of the file opening detection system 1 is the image data 19 of the Web server 4, and this image data 19 is used by introducing, for example, 1-dot image data or this system. A company logo is preferred. By configuring in this way, it becomes difficult for an unauthorized opener of the electronic file 2 to notice the fact that it is trying to detect the opening of the file. For example, if the image data 19 is 1-dot image data, a message indicating that an image cannot be displayed in the 1-dot area is displayed even if the electronic file 2 is opened in a place where the Web server 4 cannot be accessed. Therefore, in practice, an unauthorized opener of the electronic file 2 cannot confirm the error message with the naked eye. Further, even if the image data 19 can be acquired from the Web server 4 and displayed on the electronic file 2, it is still displayed in a 1-dot area. It is quite difficult to confirm. That is, it is difficult to be noticed by an unauthorized opener of the electronic file 2. In addition, when the image data 19 is a logo mark of a company that uses and introduces this system, an unauthorized opener of the electronic file 2 displays the logo mark of the company that had the electronic file 2 obtained illegally. Therefore, it is difficult to notice that the electronic file 2 is detected to be opened illegally.

  The above-described embodiments are preferred examples of the present invention, but the present invention is not limited to these, and various modifications and changes can be made without departing from the scope of the present invention. is there. For example, the web server 4 has stored in the storage unit 15 an opening permission list 18 that allows opening of the electronic file 2, but the opening prohibition list (not-ready) in which IP address information for which opening is prohibited is registered. May be stored in the storage unit 15. Thus, for example, when there is an operation rule that allows the electronic file 2 to be used only in a part of the network in the company, the IP address at the place where the opening of the electronic file 2 is prohibited is explicitly registered, By checking this, it is possible to easily confirm whether or not the operation rules are observed.

  In addition, when there are a plurality of types of electronic files 2 for which unauthorized opening is to be detected and each user wants to permit opening in different ranges, a plurality of image data 19 referred to by the Web server 4 are prepared and each image is opened. The opening permission list 18 may be set so as to hold the IP address information that permits permission. Thereby, a place where opening of a plurality of electronic files 2 is permitted is set, and this is an effective means when it is necessary to detect unauthorized opening information. In the present embodiment, the Web server 4 is used as the computer in which the image data 19 is stored. However, the computer may not be a Web server. For example, a NAS (Network Attached Storage) or a file server configured to be connectable from the outside. It may be.

  Further, the unauthorized opening information extraction unit 13, the mail notification unit 14, and the unauthorized opening extraction program 16 and the opening permission list 18 stored in the storage unit 15 of the Web server 4 are physically different from the Web server 4. May be configured to communicate with the Web server 4 and appropriately monitor the log data 17.

  The log data 17 is configured to be recorded when an acquisition request for the image data 19 is made to the Web server 4 triggered by the opening of the electronic file 2, but there is an acquisition request for the image data 19. In this case, the log data 17 may be recorded only when it is determined that the tampering has been performed with reference to the unsealing permission list 18. In the case of such a log recording method, the unauthorized opening information extraction unit 13 may determine only the presence or absence of the log data 17.

  Further, all or part of the processing executed in the file opening detection system 1 described in the above-described embodiment is configured by a program, and the program is installed directly from a medium recorded in an executable state. Or it can be installed on a remote computer via a network.

DESCRIPTION OF SYMBOLS 1 ... File opening detection system, 2 ... Electronic file, 3 ... Network, 4 ... Web server, 5 ... Administrator terminal, 11 ... Control part, 12 ... Log recording part (an example of an opening information recording part), 13 ... Unauthorized opening Information extraction unit, 14 ... email notification unit (an example of an unauthorized opening information notification unit), 15 ... storage unit, 16 ... an unauthorized opening detection program, 17 ... log data, 18 ... opening permission list (an example of an opening / disapproval storage unit), 19 ... Image data

Claims (5)

Based on the data acquisition request from the electronic file in which the hyperlink is embedded, the opening information recording unit that records the opening log information including at least the IP address information that is the transmission source of the data acquisition request;
An opening / closing storage unit storing IP address information for determining whether the electronic file can be opened;
Unauthorized opening log information that is opened at an IP address that is not permitted to be opened from the opening log information recorded in the opening information recording unit with reference to the IP address information stored in the opening permission / inhibition storage unit An unauthorized opening information extraction unit for extracting
An unauthorized opening information notifying unit for notifying a predetermined mail address of the unauthorized opening log information extracted by the unauthorized opening information extracting unit;
A file opening detection system characterized by comprising: The file opening detection system according to claim 1,
The hyperlink embedded in the electronic file indicates predetermined image data,
The file opening detection system according to claim 1, wherein the predetermined image data is one-dot image data or a logo mark of a company that uses and introduces the system. Based on the data acquisition request from the electronic file in which the hyperlink is embedded, the opening information recording step for recording the opening log information including at least the IP address information that is the transmission source of the data acquisition request;
An IP address that is not permitted to be opened from the opening log information recorded in the opening information recording step with reference to an opening availability storage unit that stores IP address information for determining whether the electronic file can be opened An unauthorized opening information extraction step for extracting the unauthorized opening log information opened at
An unauthorized opening information notification step of notifying the predetermined email address of the unauthorized opening log information extracted by the unauthorized opening information extraction step;
A file opening detection method characterized by comprising: Computer
Based on the data acquisition request from the electronic file in which the hyperlink is embedded, the opening information recording means for recording the opening log information including at least the IP address information that is the transmission source of the data acquisition request;
An opening / closing storage unit storing IP address information for determining whether the electronic file can be opened;
Unauthorized opening log information opened with an IP address that is not permitted to be opened from the opening log information recorded in the opening information recording means with reference to the IP address information stored in the opening permission / inhibition storage means Unauthorized opening information extraction means for extracting
Unauthorized opening information notifying means for notifying the predetermined mail address of the unauthorized opening log information extracted by the unauthorized opening information extracting means;
File opening detection program to make it function.   An electronic file used in the file opening detection system according to claim 1 or 2.

Images